Malicious PDF — malware analysis report

Static analysis result for SHA-256 23b8b4d36dccdb79…

MALICIOUS

PDF

27.6 KB
MD5: fd791dcd78cafd446203f2c2a8d3ea37 SHA-1: 3212e8523a90b7e12e11e0c56928c1b59537820d SHA-256: 23b8b4d36dccdb79e6c56035b9184abb431d6fd885a565b28229bad68a446957
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file was flagged as malicious by multiple engines, including ClamAV which identified it as Win.Trojan.Agent-36100. It contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier also assigned a high probability of maliciousness. The embedded JavaScript is likely responsible for downloading and executing a second-stage payload, although the specific actions are not detailed in the provided evidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Win.Trojan.Agent-36100 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Agent-36100
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • JavaScript action low PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js
47211720afbf5ac2ab2a12743a72f2c92bd1a72069a2917bf2664b8dd6edbde4		 pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 27477 bytes
Detection
ClamAV: Win.Trojan.Agent-36100
Obfuscation or payload: unlikely
legacy_pdfkit_stage_000.js
4e80f0119f46bacc8dd8f2ebb0817ddf0801165b4808e8162aa2ab47934a8997		 deobfuscated-js double percent-decoded annotation JavaScript at offset 0x1E7 15117 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.